Slashdot Mirror
New Destover Malware Signed By Stolen Sony Certificate
Trailrunner7 writes: Researchers have discovered a new version of the Destover malware that was used in the recent Sony Pictures Entertainment breaches, and in an ironic twist, the sample is signed by a legitimate certificate stolen from Sony. The new sample is essentially identical to an earlier version of Destover that was not signed. Destover has been used in a variety of attacks in recent years and it's representative of the genre of malware that doesn't just compromise machines and steal data, but can destroy information as well. The attackers who have claimed credit for the attack on Sony have spent the last couple of weeks gradually releasing large amounts of information stolen in the breach, including unreleased movies, personal data of Sony employees and sensitive security information such as digital certificates and passwords. The new, signed version of Destover appears to have been compiled in July and was signed on Dec. 5, the day after Kaspersky Lab published an analysis of the known samples of the malware.
gets better everytime. This is not news anymore, it is a damn mexican soap opera.
So? Does this really mean anything for the consumer?
It's not that Sony haven't used that certificate to sign malware before and it's not like I care if the malware is from Sony or some dude in Azerbaijan.
Anyone working in IT will have no doubt come across those who I refer to as the "Certificate Crazies".
These are people who, when confronted with a security issue of some sort, immediately try to remedy it with certificates.
They insist on using certs everywhere from ssh authentication to signing apps. If certificates can be used, even if it makes the work unnecessarily awkward or even if it doesn't actually help in any way, they will insist on using certificates.
And then normal people work around the awkwardness that certificates often bring, rendering them irrelevant.
In practice, a certificate is nothing more than a long password that's impossible for a normal human to memorize. So it ends up in a file somewhere, if not several "somewheres", where it can be easily stolen. Unlike the password in somebody's head or even on a sticky note behind the monitor, these certificate files can often be stolen remotely!
Meanwhile, the "Certificate Crazies" deny that this is a problem, even when confronted with stolen certificates that have been misused!
After railing against passwords for so long, how they do these "Certificate Crazies" often suggest getting around problems with stolen certificates? Why, they recommend using a short, human-friendly password that's needed in order to use the certs!
These people are a joke.
What benefit does the attacker get by signing the malware with a company's certificate?
Good that Sony is in many people's "No Buy" list: this way the malware can't do much harm, right?
(Captcha was "viruses". Creepy, huh?)
Just yesterday, they were the bastion of trustworthy software. Now this!
SJW's don't eliminate discrimination. They just expropriate it for themselves.
Systems Affected: Windows 2000, Windows 7, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Server 2008, Windows Vista, Windows XP ..
http://www.thebestpageintheuniverse.net/c.cgi?u=sony_bullshit
If we are talking about those who would use certificates and trust verisign/thawte/etc, I agree with your sentiment. In practice, that actually is how the cards are stacked (particualrly with microsoft's library, which doesn't make it easy to do otherwise).
Certificates are not so bad if you apply it more precisely, so that certain subsystems are highly selective about trusting CAs that are pertinent only to that subsytem. For example, a company having an internal CA should not trust other CAs for internal use. By the same token, that CA should have constraints such that it won't be trusted to sign thinks like bank domains.
Of course you are saying about user authentication, which is a trickier thing, while this article and I are talking about code and server certificates. User authentication is a lot more subjective since it relies as much upon human behavior as anything without much recourse to train it out.
The scale of the Sony hack should have prompted the System admin to revoke any, and all certs that had the slightest possibility of being compromised. You can't keep the hackers out of your new fixed system if you still honor the certs they stole.
Windows 3.1 is not listed.
It little behooves the best of us to comment on the rest of us.
From ISC SANS
"Update: Turns out that the malware sample that Kaspersky was reporting on was not actual malware from a real incident. But the story isn't quite "harmless" and the certificate should still be considered compromised. A researcher found the certificate as part of the SONY data that was widely distributed by the attackers. The filename for the certificate was also the password for the private key. The researcher then created a signed copy of an existing malware sample retrieved from Malwr, and uploaded it to Virustotal to alert security companies. Kaspersky analyzed the sample, and published the results, not realizing that this was not an "in the wild" sample. [1] The certificate has been added to respective CRLs."
Well, it wouldn't be the first Sony-signed rootkit...
"Screw Sun, cross-platform will never work. Let's move on and steal the Java language." - Visual J++ Product Manager